󠁧󠁢󠁥󠁮󠁧󠁿 A UK council breach reported in July turned out to be one of many, tied to mass SonicWall exploitation

CVE-2026-15409 is an unauthenticated server-side request forgery in the SonicWall SMA1000 WorkPlace interface (port 443) with a CVSS score of 10.0, allowing an attacker to tunnel arbitrary TCP to localhost services through the /wsproxy WebSocket endpoint. The bug affects SMA1000 Series models 6210, 7210, and 8200v running versions including 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800. Rapid7 observed active exploitation before SonicWall's July 14 disclosure, with a proof-of-concept published July 15, and both CVE-2026-15409 and CVE-2026-15410 were added to CISA's Known Exploited Vulnerabilities catalog. The operator used a modified Rapid7 PoC to scan for vulnerable appliances with 50 concurrent threads, then exploited the Erlang distribution node on localhost:1050 to gain command execution as the couchdb user, deployed a standalone Linux Impacket secretsdump binary to /tmp/secretsdump, and performed DCSync replication against Active Directory domain controllers.

The King's Lynn and West Norfolk Borough Council breach on July 17 is not an isolated incident; Hunt.io assesses with moderate confidence that it is one of at least 250 exploitable targets identified in the campaign inventory. The operator extracted LDAP configurations from 168 appliances, covering 160 unique Active Directory domain names and 255 internal LDAP endpoints, and recovered SAM and LSA secrets from at least nine AD domains with full DRSUAPI-based DCSync succeeding against seven domain controllers across five environments. Confirmed credential theft spans France, India, Italy, and the United States, with the broader target inventory including the United Kingdom, Canada, Germany, Sweden, Poland, Hungary, South Korea, and Hong Kong. Most organizations barely monitor the underlying operating system of their VPN appliances, which is exactly why the operator could stage credential dumps on /tmp, download secretsdump from 95.181.173.36 over HTTP, and pivot into internal networks without triggering endpoint detection. This story stands out not because a council was breached, but because the same open-directory evidence that revealed 250 targets shows most of the others were never reported, meaning the actual exposure footprint is far larger than any news cycle will cover.

Defenders should treat exposed SMA1000 appliances as presumptively compromised and upgrade immediately to platform hotfix 12.4.3-03453 or 12.5.0-02835; SonicWall confirms there are no workarounds. Hunt logs should be reviewed for extraweb_access.log entries containing "GET" and "wsproxy" and "=-3389" with suspicious host parameters such as "localhost" or "::ffff:127.0.0.1", ctrl-service.log showing /usr/local/bin/remove_hotfix invoked with traversal sequences, and authentication API hits against /api/login or /api/logout. On the internal side, hunt for NTLM logons (Windows Event ID 4624, logon type 3) originating from the appliance's internal IP address with non-corporate workstation names such as kali or DESKTOP-KRLUI3J, and inspect /tmp for the file secretsdump (SHA-256: 690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b) or /tmp/dump_[DC].out artifacts. If compromise is confirmed, SonicWall advises re-imaging or redeploying the appliance, changing all administrator and user passwords, and resetting TOTP tokens.

The assessment would shift if the open-directory data at 95.181.173.36 is confirmed to represent the complete campaign rather than a subset, or if SonicWall releases additional CVEs or revised hotfixes beyond the current 12.4.3-03453 and 12.5.0-02835 releases. Another critical change would be confirmation that DCSync replication has expanded beyond the five domains and seven domain controllers already identified, or that the operator has shifted from opportunistic scanning to targeted verticals. Until then, the evidence points to a single campaign that started two days after disclosure, used a public PoC, and left its entire toolkit exposed in an open directory.